Slashdot Mirror
Window Pain
Occasionally while I'm surfing the web and a pop-up ad opens, my Norton Anti-Virus will alert me that it blocked an "attack" on my computer, and then in Norton's logs of recently blocked attacks, it gives the URL of the content inside the pop-up ad that was blocked. Sometimes it indicates whether the "threat" was blocked under the category "scareware" (an ad that mimics a program scanning your PC for viruses and then claiming to find "infections," which you have to remove by purchasing the advertiser's software) or "malware" (an advertiser's page that tries to infect your computer directly by using JavaScript tricks to get around the browser's security features). I'm glad that Norton blocks the malware attacks, since even though I always have all the latest security patches installed for Internet Explorer, it's always possible that an attacker could be using an exploit that hasn't been patched yet. I don't really care about blocking the "scareware" ads, because I'm not going to fall for an ad that claims to be scanning my PC for viruses, but most Norton customers probably appreciate blocking those ads as well.
The problem in both cases is that it's hard even for an experienced user, and almost impossible for a novice user, to know where to send a complaint about the content in a pop-up window. You can usually figure out the URL of the content in the pop-up window (just right-click the window content and pick "Properties" in Internet Explorer or "View Page Info" in Firefox), but often the content itself is being served from an IP address in a jurisdiction like China or Cyprus where malicious operators are hard to shut down. What you really want is for them to stop serving their dangerous ads on reputable websites through the ad network. You could complain to the owner of the website that you're browsing, and say that a pop-up ad window from their site got blocked by Norton as a "virus," but if their site rotates ads from different providers, the site owner would have no way of knowing which advertising network served the ad. Even if you know the URL of the malicious content that was in the pop-up window, that's not enough to tell which advertising network it was served from (because ad networks typically don't serve the ads from their own domain; they just serve a redirect, which causes the browser to load the pop-up ad's contents from the advertiser's domain).
And even if you know which advertiser network served the ad, and the URL that the malicious pop-up content was served from (say, http://www.evilsite.cn/popup.html), so you can take your complaint directly to the advertising network, that may still not be enough information for them to figure out which of their advertisers served the malicious content and needs to be booted out of the network. Because all the advertiser network has is a list of ad pages for their different advertisers (http://www.advertiser-1.com/ad.html, http://www.adveritser-2.com/ad.html, etc.) — the advertiser buys the right to show ads, and the ad network displays ads that load content from those ad content pages. If one of those pages — say, http://www.adveritser-2.com/ad.html — redirects the user's browser to http://www.evilsite.cn/popup.html, the advertiser network has no way of knowing which advertiser is doing that. They would have to go through and check the ad-serving pages (http://www.advertiser-1.com/ad.html, http://www.adveritser-2.com/ad.html, and so one one at a time) for each of their advertisers, to see which of those pages redirect to http://www.evilsite.cn/popup.html — and by the time they do that, the advertiser might have altered the page so that it no longer redirects to the malicious content. While it's pretty straightforward to figure out what URL the malicious content is being loaded from, it's very difficult to figure out the chain of events that redirected you there, and who the responsible parties are.
So here's an idea for a simple browser feature that would make it a lot easier to hold malicious advertisers accountable, and get them kicked out of honest ad-serving networks. Simply give the user a way to right-click on the top of a browser window, and pick "View window origin" or something similar. This would display the sequence of redirects that opened the window, something like this:
Browser was visiting http://www.cnn.com/
http://www.cnn.com/ loaded JavaScript from http://www.advertiser-network.com/ads.js
http://www.advertiser-network.com/ads.js redirected browser to http://www.advertiser-2.com/ad.html
http://www.advertiser-2.com/ad.html redirected browser to http://www.evilsite.cn/popup.html
Then, if the user views an ad that is obviously scareware (or if Norton blocks the contents from loading and gives that as a reason), then the user can just right-click on the window and see the list of redirects. The user could then e-mail that to the website owner with a suggestion to do something about it ("The ad network on your page, has been infiltrated by an advertiser who is using the ad network to serve malicious content"), or the user could take the complaint to the advertiser network. The advertiser network would be able to see from the log, exactly which of their advertisers' ad.html pages served the malicious content.
(Yes, this comes on the heels of my article arguing that we should allow more intrusive ads as a way to help pay for services that can't finance themselves with normal pop-up ads. This may strike some people as "ironic" who haven't thought about it very carefully. Getting users to give larger amounts of their attention in exchange for premium service, is an honest and mutually beneficial transaction; scaring users with deceptive ads, or using ad space to try to infect their computer, is not. I think that Starbucks has the right to charge whatever they want for coffee; that doesn't mean they have the right to pee in your coffee.)
In order for this window-history-tracing feature to make a difference, at least the following two conditions also have to be true:
- The advertiser network has to be honest (honest enough to kick out advertisers who they know are serving malicious content), or at least, be located in a jurisdiction where they have to worry about being sued or prosecuted if they don't kick bad apples out of their network.
- When the malicious ads are served, enough users have to complain about them that the advertiser network takes notice. You wouldn't want the advertiser network to take action just based on a single complaint, since then anyone with a grudge could file a phony complaint against an advertiser in order to get them shut down, but if complaints start coming in from several sources, then they should investigate.
Fortunately, these would be likely to be true in many if not most cases where malicious pop-up windows are being served. With regard to the first condition, I've dealt with several advertising networks to find ads to serve on the proxy sites that I run, and they were all based out of law-and-order countries (the U.S., Canada, Israel, i.e. not China or Kazahkstan). As for the second condition, the advertiser would probably have to serve the ad to many different users in order to achieve their goal -- whether their goal is to infect users' machines, or to get them to buy the advertiser's fake anti-virus software, or whatever -- and as long as a fixed percentage of users viewing the malicious ads are inclined to file complaints about them, then the more the ads are served, the more complaints will come in until the ads are taken out of rotation.
Of course, if the URL that's actually serving the malicious content, is located in a law-and-order country, you could always just complain to the admins of the network where the content is being hosted. But that's likely to be less effective, since (a) the actual URLs that I've seen serving the malicious content, usually are located in cybercrime-infested nations like China, and (b) even if you get one of those sites shut down, the advertiser can instantly rotate in other sites with the same content, and make that the new URL that users are redirected to.
It is also of course true that some pop-up ads are spawned not by websites, but by malicious programs that actually infect your machine and force your browser to display pop-up windows. If some browser maker adopted the feature I'm suggesting, and stored a user-viewable "history" associated with each pop-up window, then a malicious program running on your machine might even be able to spoof the history associated with a pop-up window, so that the user would right-click on it and think it came from http://www.cnn.com/ instead of being spawned by malware. Once the user has their machine infected by a rogue program, nothing that any other application tells them can really be trusted after that point. So an advertiser network would have to be careful not to take action against an innocent third party, just based on a flood of complaints that were sent in by people whose machines were infected by malware that spoofs the origin of the pop-up windows. Fortunately, if the allegedly malicious ad is still in rotation, it would be easy for the advertiser network to check the validity of the complaint, by simply going to the advertiser's ad-content page, and seeing if it redirects to the malicious content. If it does, then you have grounds to boot the advertiser out of the network.
(You'd want to check the page's content from some anonymous IP address not affiliated with the advertiser network though. Otherwise, the advertiser might try to fool the ad network people, by showing "innocent" content when the page is loaded from the IP addresses associated with the ad network's office, and serving the scareware content to everybody else. Just trying to think of everything here.)
I'm sure there are other counter-strategies and counter-counter-strategies that would have to be taken into account, and kinks to be worked out, but probably not fatal to the whole idea. If a pop-up window opens on the user's computer that is possibly illegal, it is probably a good thing to give the user the tools to figure out where the ad came from, and which advertiser network to complain to. Right now, the ad window just floats there, and it's maddening not to have any way of knowing which ad-serving network put it there, or even if you can identify the ad-serving network, which of their advertisers created the content.
The main obstacle standing in the way of a major browser maker implementing this, may be that it doesn't bring any particular benefit to the users of that browser. When Microsoft adds SmartScreen to Internet Explorer, they can now claim that IE users are better-protected than users of other browsers. On the other hand, if the Mozilla Foundation adds the pop-up window right-click-history feature to their browser, they can't legitimately claim that Firefox users are better protected, since this feature wouldn't actually block anything. Firefox users would simply be better equipped to complain about malicious pop-up windows, and increase the chances of those rogue advertisements being taken down, or at least kicked out of ad networks where they would do the most damage. However, the benefits of that increased policing, would accrue to all Internet users, not just Firefox users.
Still, abuse desks get so many complaints about spam and spammers, that there are apparently plenty of people out there who get enough satisfaction from complaining about net abuse, that they would make use of the pop-up window-tracing feature if they had it. I know that when I see a stupid ad pretending to "scan" my computer for viruses, I get unreasonably disgusted, not from seeing the ad itself (which I can easily ignore), but from knowing that the advertiser has probably fleeced people of thousands of dollars with that ad. It would be nice to be able to help stop them before they cheat the next person.
I can't recall the last time I have seen a pop-up ad with the above configuration. They literally aren't a problem for me. Oh, and I run Linux, so it doesn't matter anyway...the code won't execute.
I mean did you really need to write this long-winded meaningless rant? just download firefox and ad-block pro.
Arash Partow's Philosophy: Be a person who knows what they don't know, and not a person who doesn't know.
Occasionally while I'm surfing the web and a pop-up ad opens, my Norton Anti-Virus ...
Huh, I fail to identify with your underlying scenario. I have the latest vanilla Firefox here (not even adblock or noscript) and it does a mighty fine job of blocking popups and letting me know if it did with a tiny bar that comes down. Now, if I didn't do something that would cause a popup on the site, I just ignore it. This works 99% of the time. The other 1% is some less than reputable video site using my "click to play" action in a Flash video to launch a popup that Firefox doesn't catch. Oh well, I make due just fine.
I'm glad that Norton blocks the malware attacks, since even though I always have all the latest security patches installed for Internet Explorer ...
This would be the point in your investigative security piece (which you are delivering to a pack of highly caffenated, know-it-all, technology sector employed nerds) that you point out that you are only using this to mimic the average user's experience or you're doing this to criticize Microsoft or just that you normally use a more secure solution than this. Otherwise at best your credibility may suffer and at worse a frothing melee of insults will ensue ... some possibly in Klingon delivered from a goeteed man pushing three bills. I find these to be most unpleasant experiences ... both as the victim and the bystander so I wish you the best of luck and remind the audience to please be gentle.
My work here is dung.
Pop-ups in Internet Explorer? How quaint. I've forgotten what browsing in the late '90s was like since I've been using FIrefox for so long. Haven't seen a pop-up in ages. Thanks for the blast from the past.
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
What ads?
> head -5 /etc/hosts
##
# Host Database
#
# This MVPS HOSTS file is a free download from:
# http://www.mvps.org/winhelp2002/
No, you fucking plebeian. Bennet Hasselton has two last names, and both of them are extra snooty, therefore you will read all of Bennet Hasselton's exquisitely crafted prose and you will like it. A genius like this is doing us all a service by sharing his wisdom, so get out a spoon and eat that shit up.
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
Yeah, but this article is discussing the state if the industry, not how an expert user can avoid popups and other scareware/malware.
.01% of us slashdotters that are the problem with malware infections, it is the millions of joe sixpacks that care not to go through the trouble that it takes to install and then browse with these specialized browsers and plugins.
There are loads of machines out there being infected today by doing normal browsing on reputable sites. With the current industry practice of n-number of redirects through n-number of networks for 3rd party ad serving it makes it near impossible to track down those of nefarious intent on an incident level.
Once again it is not the
I for one agree, something must be done; and "open letters" like this are often how the conversation starts.
Firefox + NoScript + Adblock Plus alone does alright for me. NoScript has options to block embedded content under options so adding FlashBlocker is a little redundant for my taste.
I've lost all my marbles except one & It's fun to test angular & centripetal acceleration in my skull
Occasionally while I'm surfing the web and a pop-up ad opens, my Norton Anti-Virus will alert me that it blocked an "attack" on my computer
Wait a second... he has a computer powerful enough to get pop-up ads while running Norton Anti-Virus?
"Always forgive your enemies; nothing annoys them so much." - Oscar Wilde
I have helped a few sites track down and remove scareware. give them as many details as you can.
My host name and IP from http://www.displaymyhostname.com/
The time I was on the page. What page you were on.
One thing I do is leave the site alone for a day so when I report it, I can tell them it was the last visit to the site. A detail like that helps when looking at logs. The hostname gives them where your located so if the add network uses locations to send adds, this will help.
part of the problem is that these sites will take real adds for real services and have them link to the real site. This helps them pass, then they push out a redirect script later or built in with a trigger to cause the redirection.
Its not often they can or take the time to track it down. But it sure feels good when they tell you they tracked it down because of your help.
Im a gamer, not a grammer major. This post is full of spelling and grammer mistakes.
Parent is not a troll. There's two huge red flags that popped up right at the beginning of TFS:
One, he's using Norton, which anybody knows is ripe for ridicule in this particular forum.
Two, as has and will be mentioned numerous times, Noscript, adblock, etc. make all this very academic (which, I know, is the point of Bennet's writings here, to explore concepts in theory).
So while I'm sure his opinion is interesting to whatever eggheads here like to digest his cromulent but otherwise semantic ramblings, the rest of us will do pretty much what parent has done and say "who gives a fuck?"
Linux, you magnificent bastard, I read the fucking manual!
Here's a solution, don't patronize any site that uses those types of advertisements. There is NOTHING on the site you can't get elsewhere with less crap. NOTHING.
I don't go to sites that have crap splashing all over my screen. I'll do without thank you very much. If a site expects me to use IE, I won't go. If a site wants to bombard me with flash for no reason other than to look ...well flashy, then I won't go. If a site wants to use javascript to do all sorts of stupid stuff to "look pretty", then it isn't getting me to visit again.
If you go away, and don't return, and you find sites that give you what you want without all the crapware pieces then they will learn. As for idiots who don't understand, stupid should hurt.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
It's convenient that you can block ads in web browsers. That may be on the way out.
You can't block ads on the iPad. One of the "advantages" being touted to advertisers for the closed ecosystems of the various "ereaders" and "pads" is that they can have unblockable, unskippable ads. There hasn't been much about this in the popular press yet, but it's being of great interest in the advertising community, where more "control over the user experience", and less control by the user, is desired.
You can already see a trend in this direction, with Flash-based video players which insert unskippable ads.
Ads are being served to users that do not want them - but the advertisers are paying. Who exactly is the customer here? The end user viewing the ad or the advertiser? What the poster missed here is that there are four players here:
OK, so who is in control of what here? Well, the web site operator is selling "time" or "visitors" and might like to exhert some kind of control over the ads but isn't offered any such control. Try convincing Google that you do not want to see any ads for multi-level marketing scams on your web site. Go ahead, try. No good, huh? No, you don't have much control - maybe you can say no to "adult" ads.
The ad purveyor has complete control, but they are being paid plenty to post ads. All kinds of ads. They are heavily isolated from the end user, such that even if the end user finds out the CEOs phone number what exactly are they going to do? The end user is not paying the ad purveyor - the advertiser is.
You will never find the advertiser to complain, and even if you did it wouldn't matter. If you are going to advertise on the Internet you have to be immune to complaints. Someone is going to complain all the time. And it doesn't matter because the end user has no control whatsoever.
Sure, the end user can annoy the web site operator - who, by the way, is getting paid plenty to sit and take the complaints and do nothing. Even if the web site operator wanted to do something they have no control. They have two choices - stop advertising and stop the flow of money, or ignore the complaints. The "threat" of moving to a different advertising purveyor is hollow - there are no "different" or "better" purveyors - just those that pay less. The object here for the web site operator is to get as much for their "product" (visitors seeing ads) as possible. End user complaints have no meaning unless you have four visitors that just keep coming back.
Oh, and the advertiser just doesn't care what anyone thinks about this process. After all, they are the ones pushing misleading or harmful content, right?
It is all about control, power and relationships. If you don't understand that you need to sit down and think this stuff through. The Internet today is a fundamentally abusive relationship for the end user. They are the "bottom boys" being dominated and get to take whatever is coming their way. Don't like it? Try a different browser that (hopefully) blocks ads better. If you visit web sites where there are ads, you are going to be subjected to ads - abusive, misleading and harmful ads. Your ability to affect this is small indeed - you can try to block the stream of ads coming your way or you can avoid the more heavily ad-laden web sites.